Filters and event schema for categorizing and processing streaming event data

ABSTRACT

Disclosed are various embodiments for filters and event schema for categorizing and processing streaming event data. An event may be generated by a service that describes user interaction a client application executable on a client device. The event may be received as a data structure in a first format. A filter, such as a regular expression filter, may be applied to the data structure to identify an event type for the event. The data structure may be converted from the first format to a second format in accordance with a common event schema able to be interpreted by virtual compute engines.

BACKGROUND

Large-scale data processing systems such as web services and the likecan produce vast amounts of log data including data generated by variousend users, such as visitors of a network site and users of a mobileapplication. From time to time, it may be desirable to review such datato identify events of interest. For example, a marketing department maydesire to identify behavioral patterns of individual users. However, thequantity of log data generated by such systems may present significantdifficulties in terms of data storage and review. Querying data storeshaving millions to billions of entries, for example, may consumebandwidth, monopolize computing resources, and provide slow searchresults.

BRIEF DESCRIPTION OF THE DRAWINGS

Many aspects of the present disclosure can be better understood withreference to the following drawings. The components in the drawings arenot necessarily to scale, with emphasis instead being placed uponclearly illustrating the principles of the disclosure. Moreover, in thedrawings, like reference numerals designate corresponding partsthroughout the several views.

FIG. 1 is a drawing of an event monitoring system implemented as anetworked environment according to various embodiments of the presentdisclosure.

FIG. 2 is another drawing of the event monitoring system of FIG. 1according to various embodiments of the present disclosure.

FIGS. 3A-3C are drawings showing embodiments of an event communicated inthe event monitoring system of FIG. 1 according to various embodimentsof the present disclosure.

FIG. 4 is a state machine diagram for a state machine of the eventmonitoring system of FIG. 1 according to various embodiments of thepresent disclosure.

FIG. 5 is an example user interface rendered by an administrator clientdevice in the event monitoring system of FIG. 1 according to variousembodiments of the present disclosure.

FIG. 6 is a flowchart illustrating functionality implemented by an eventprocessing application executed in a computing environment of the eventprocessing system of FIG. 1 according to various embodiments of thepresent disclosure.

FIG. 7 is a flowchart illustrating functionality implemented by an eventtranslator executed in the computing environment in of event processingsystem of FIG. 1 according to various embodiments of the presentdisclosure.

FIG. 8 is a flowchart illustrating functionality implemented by acompute engine executed in the computing environment of the eventprocessing system of FIG. 1 according to various embodiments of thepresent disclosure.

FIG. 9 is a schematic block diagram illustrating of a computingenvironment employed in the event processing system of FIG. 1 accordingto various embodiments of the present disclosure.

DETAILED DESCRIPTION

The present disclosure relates to patterns for categorizing andprocessing streaming event data. More specifically, the presentdisclosure relates to applying a filter to classify an event andtransforming events from disparate sources into a common event schema.It may be desirable to monitor user interactions with computerapplications, for example, to improve customer experience, marketpotential goods and services to customers, drive engagement, or monitoruser behavior. However, events performed by users in those computerapplications, if recorded, can amass quickly in a data store,potentially totaling millions to billions of entries. The quantity ofdata may present significant difficulties in terms of review. Forexample, marketing personnel may want to analyze customer behavior witha company's software application to determine how to better market aproduct to a person based on their behavior. However, running queries ondata stores having millions to billions of entries of user interactionsmay be problematic due to limitations in database processing, bandwidth,and other computing resources. Additionally, providing search results ina timely fashion may be difficult.

An event monitoring system may be provided to monitor user-generatedevents in real-time to identify behavioral patterns as they occur.Events may include interactions performed by a user in association witha particular application, such as a web browser, a media player, areading application, a shopping application, or other similar type ofapplication. To this end, events may include, for example, interactingwith a user interface component, viewing a product page for a particularitem in a shopping application, purchasing an item, starting playback ofa movie or song in a media player, finishing a virtual novel in a bookreading application, or other similar action.

Issues may arise when events are received from different sources indifferent data formats. For example, an order transaction system thatpublishes events for users that order items in a shopping applicationmay generate events that include an order identification number, atransaction time, and a price. A video streaming system, however, maygenerate an event that includes a title, a critics rating, a videolength and a video category. Events from the order transaction systemcan assume a JavaScript object notation (JSON) format while events fromthe video stream system assuming an extensible markup language (XML)format. As any logic that analyzes these type of events may depend onparticular data fields and a format of the event, additional logic wouldbe required to handle all possible formats of an event. Additionally,complexity of understanding disparate data formats increases as eventsare received from an increasing number of sources.

According to various embodiments described herein, an event translatorof the event monitoring system may be employed to classify events andtransform event data structures into a format desirable by a computeengine, which may comprise a virtualized computational unit thatcompares events to patterns, as will be discussed. In one embodiment, anevent is received in a stream of events generated by disparate services,where the event describes at least one instance of user interaction withat least one client application executable on a client device. A filteris applied to the event data structure to classify the event or identifya type of the event. In some embodiments, the filter may comprise aregular expression filter. The event data structure may be transformedor converted from a first format to a second format according to acommon event schema. Further, one or more compute engines requiringaccess to the event may be identified and the data structure in thesecond format can be communicated to the compute engines requiringaccess (referred to herein as “an interested compute engine”).

In the following discussion, a general description of an eventmonitoring system and its components is provided, followed by adiscussion of the operation of the same.

With reference to FIG. 1, shown is an event monitoring system 100according to various embodiments of the present disclosure. The eventmonitoring system 100 includes external computing resources 103 thatinclude a number of services 106 a . . . 106 n (collectively “services106”), as will be described. Generally, the services 106 report events109 a . . . 109 n (collectively “events 109”) to a computing environment112 for analysis. Events 109 can describe interactions with a clientapplication 118 executable on a client device 121, as will also bedescribed.

In one embodiment, each of the services 106 are executed on one or moreservers or other hardware with like capability to serve up network datato the client device 121, as well as observe interactions with theclient application 118. For example, the services 106 may serve upnetwork pages to the client devices 121 or data used to generate userinterfaces in a dedicated application. As the services 106 serve up thenetwork data to the client devices 121, the services 106 can beconfigured to observe when a user manipulates a hyperlink, a button in auser interface, or performs another type of action, such as purchasingan item in an electronic commerce system, playing a movie, and so forth.As interactions are observed, the services 106 may be configured tocommunicate an event 109 to the computing environment 112 describing aninteraction with a client application 118 as soon as it is identified,or shortly thereafter.

The services 106 may communicate events 109 to the computing environment112 over a network that may include, for example, the Internet,intranets, extranets, wide area networks (WANs), local area networks(LANs), wired networks, wireless networks, or other suitable networks,etc., or any combination of two or more such networks. For example, suchnetworks may comprise satellite networks, cable networks, Ethernetnetworks, and other types of networks.

The tasks performed by each respective service 106, such as serving upcontent to client applications 118, may be independent of the tasksperformed by other ones of the services 106. In this respect, eachservice 106 may be disconnected or independent of the other services106. Stated another way, no one service 106 knows about the operationsor tasks performed by any of the other services 106. Thus, the services106 may operate independently of each other.

The services 106 may include event reporting agents 124 a . . . 124 n(collectively “event reporting agents 124”). Each of the event reportingagents 124 may include logic that operates in conjunction with aparticular client application 118 or function of a client device 121 tomeasure user interaction. In other words, the event reporting agents 124generate events 109 describing interactions that are transmitted to acomputing environment 112 over a network. In some embodiments, the eventreporting agents 124 can be executed on the client device 121, forexample, as a component of the client application 118 or as a standaloneapplication.

For a given service 106, events 109 generated by the service 106 may bein a format different from other events 109 generated by other services106. As the services 106 operate independently, they potentially produceevents 109 in a variety of disparate formats. For example, one of theservices 106 may communicate events 109 in a JSON format while anotherone of the services 106 may communicate events 109 in an XML format.Additionally, a data structure for an event 109 may vary from oneservice 106 to another.

For instance, a client application 118 may include a media playerapplication that plays media files, such as music or movies. If a userselects “play” in the media player application, an event 109 describingthat interaction can be generated by the service 106 and sent to thecomputing environment 112 for analysis. Similarly, if the user purchasesan item in a shopping application, another event 109 describingcompletion of a purchase can be generated by a service 106 and sent tothe computing environment 112. As may be appreciated, the event 109describing the interaction with the media player may assume a formatdifferent from that of the event 109 describing the interaction with theshopping application.

The computing environment 112 may comprise, for example, a servercomputer or any other system providing computing capability.Alternatively, the computing environment 112 may employ a plurality ofcomputing devices that may be arranged, for example, in one or moreserver banks or computer banks or other arrangements. Such computingdevices may be located in a single installation or may be distributedamong many different geographical locations. For example, the computingenvironment 112 may include a plurality of computing devices thattogether may comprise a hosted computing resource, a grid computingresource and/or any other distributed computing arrangement. In somecases, the computing environment 112 may correspond to an elasticcomputing resource where the allotted capacity of processing, network,storage, or other computing-related resources may vary over time.

Various applications or other functionality may be executed in thecomputing environment 112 according to various embodiments. Also,various data is stored in data stores that are accessible to thecomputing environment 112. The data stores can include, for example, anevent data store 130, a pattern registry 133, an action registry 135, afilter data store 136, a compute engine index 137, common event schema138, as well as other data stores as can be appreciated. The data storesare associated with the operation of the various applications orfunctional entities described below.

The components executed on the computing environment 112, for example,include an event processing application 139 and other applications,services, processes, systems, engines, or functionality not discussed indetail herein. The event processing application 139 is executed toprocess events 109 received from the services 106, identify certainpatterns of events, and perform predetermined actions when patterns ofevents are identified. Processing events 109 may include classifyingevents 109 and communicating events 109 to appropriate services suchthat the events 109 may be processed in a computationally efficientmanner. To this end, the event processing application 139 may include anevent listener 140, an event translator 143, as well as other servicesnot discussed in detail herein.

In some embodiments, the event processing application 139 can generatecompute engines 145 a . . . 145 n (collectively “compute engines 145”)that process events 109. Compute engines 145 may include, for example,instances of a virtual machine, a thread, or similar process. In someembodiments, a compute engine 145 may be assigned to a particular userof a client device 121 or a particular user account. All events 109associated with the user or user account, can be provided to theappropriate compute engine 145.

The event listener 140 is executed to monitor events 109 received fromthe services 106, classify events 109, and send events 109 to computeengines 145 requesting certain types of events 109. In some embodiments,the event listener 140 receives a stream of events 109 and stores theevents 109 in a queue, buffer, or like mechanism to await processing.

The event translator 143 is executed to translate events 109 from acurrent format to another that a compute engine 145 is able tointerpret. In one example, the event translator 143 transforms a datastructure for an event 109 as received from a service 106 into a formatas defined by the common event schema 138.

The client device 121 is representative of a plurality of client devicesthat may be coupled to a network. The client device 121 may comprise,for example, a processor-based system such as a computer system. Such acomputer system may be embodied in the form of a desktop computer, alaptop computer, personal digital assistant, cellular telephone,smartphone, smartwatch, set-top box, music player, web pad, tabletcomputer system, game console, electronic book reader, or other deviceswith like capability. The client device 121 may include a display 172.The display 172 may comprise, for example, one or more devices such asliquid crystal display (LCD) displays, gas plasma-based flat paneldisplays, organic light emitting diode (OLED) displays, electrophoreticink (E ink) displays, LCD projectors, or other types of display devices,etc.

The client devices 121 may be configured to execute various applicationssuch as a client application 118 or other applications. The clientapplication 118 may be executed in the client device 121, for example,to access network content served up by the services 106 or otherservers, thereby rendering a user interface on the display 172. To thisend, the client application 118 may comprise, for example, a webbrowser, a dedicated application, etc., and the user interface maycomprise a network page, an application screen, etc. In someembodiments, the dedicated application includes, for example, emailapplications, social networking applications, word processors,spreadsheets, and/or other applications. The client device 121 may beconfigured to execute applications beyond the client application 118.

The computing environment 112 is implemented to receive events 109 fromthe services 106 and to record such events 109 in the event data store130. In doing so, the computing environment 112 may be configured togenerate a timestamp of the time that the events 109 were received andmay insert the timestamp as an attribute of the events 109 before theyare stored in the event data store 130. In addition, the eventprocessing application 139 may perform other operations on the events109 before they are stored in the event data stores 130. In someembodiments, the computing environment 112 may defer to otherauthoritative sources to record events 109 in the event data store 130.For example, the services 106 that generate the events 109 may recordevents 109 in their own data stores. In such instances, the computingenvironment 112 may include custom data adapters that can fetch events109 from these data sources, when required. This may reduce eventstorage operation at the computing environment 112 to increasecomputational efficiency, as may be appreciated.

The event processing application 139 may cooperate with administratorclient devices 175 in order to retrieve various ones of the events 109stored in the event data store 130 or data associated therewith.Additionally, the event processing application 139 can facilitatecreation of a pattern of events. A pattern of events (hereinafter“pattern 178”) may include an event 109 or collection of events 109 thatan administrator may specify to measure user interaction. For instance,if an administrator desires to receive a notification when a particularuser or group of users has watched five movies in a media playerapplication, the administrator can specify a pattern 178 that detectsfive instances of a user having watched a movie in the media playerapplication.

The event processing application 139 can further facilitate creation ofan action 182 to be performed when all events 109 in a pattern 178 havebeen completed. Referring back to the example above, an administratorcan specify a pattern 178 to identify users that have watched fivesmovies in the month of August. If the administrator desires to rewardusers who perform events 109 that match a pattern 178, the administratorcan specify an action 182 to be performed automatically when the pattern178 is complete. For example, users that watch five movies in the monthof August can automatically be provided with a coupon to rent a newmovie. The event processing application 139 may communicate withexternal applications 185 to cause performance of actions 182 specifiedby an administrator via an administrator client device 175. Externalapplications 185 may include other servers or like computer systems.

Next, a general discussion of the operation of the various components ofthe event monitoring system 100 is provided. To begin, assume, forexample, that an entity offers various client applications 118 fordownload on client devices 121 and desires to observe interactions madeby users with those client applications 118. As may be appreciated, theuser interactions can be beneficial in improving user interfaces,managing customer experiences, marketing potential goods and services tocustomers, increasing user engagement, or monitoring other types of userbehavior.

As users of the client devices 121 interact with various types of clientapplications 118 on their respective client devices 121, the services106 that provide data for those client applications 118 may identifywhat type of user interactions occur based on the type of datarequested. The services 106 may communicate data pertaining to thoseinteractions as events 109. Using events 109, the event monitoringsystem 100 can identify when patterns 178 occur. For instance, one usermay interact with a shopping application to electronically purchaseitems while another user may interact with a book reader application toread a novel or magazine. An administrator may desire to monitor theseinteractions and identify patterns 178. Additionally, the administratormay desire the event monitoring system 100 to perform an action 182 whena pattern 178 has been identified.

The computing environment 112 may generate one or more user interfacesfor access by administrator client devices 175 such that anadministrator can generate a pattern 178 and an action 182 to beperformed when the pattern 178 has been detected. For example, anadministrator may desire to reward users with a coupon who havepurchased an item in the shopping application and have watched a movieusing the media player application.

When a pattern 178 has been specified, the event processing application139 may dynamically generate compute engines 145 required to monitorusers to determine when a pattern 178 of user behavior has beenperformed. In one embodiment, compute engines 145 are generated for eachclient device 121 having access to a service 106. In another embodiment,a compute engine 145 is generated for each user account associated witha service 106. As may be appreciated, the compute engines 145 may beconfigured to sleep or hibernate, or otherwise not consume computingresources, until an event 109 has been passed to a compute engine 145 bythe event listener 140. For example, the compute engines 145 maytransition into appropriate modes of operation prior to an event 109being received.

When a compute engine 145 is generated by the event processingapplication 139, the compute engine 145 may be registered with thecompute engine index 137. Additionally, the compute engine index 137 mayretain types of events 109 for which a compute engine 145 has interest.For example, an administrator may desire to reward users who have readthree books in a week with a coupon. The administrator creates a pattern178 that seeks three events 109 that describe a user completing a book.A compute engine 145 may be generated that monitors John Doe's userinteractions. However, as the pattern 178 only requires monitoring userinteractions with a book reading application (e.g., to identify whethera user has read three books in a week), the compute engine 145 for JohnDoe should not receive events 109 unrelated to the book readingapplication. Accordingly, the event listener 140 may only communicateevents 109 having a type for which compute engines 145 are interested.

In various embodiments, the compute engines 145 may be implemented asone or more state machines 190 a . . . 190 n (collectively “statemachines 190”). The state machines 190 may comprise, for example,event-driven finite state machines where a transition from one state toanother is triggered by an event 109 being passed to a compute engine145 from the event listener 140. The state machines 190 may beimplemented programmatically using CASE and SWITCH statements availablein various programming languages. As may be appreciated, the statemachines 190 may increase computational efficiency of the eventmonitoring system 100. The state machines 190 may also be implemented byusing proprietary or customized software that natively provide finitestate machine modeling.

In some embodiments, the compute engines 145 may model the pattern 178to be matched as state machines 190 that reach a terminal state when apattern 178 is completely matched or an event 109 is received thatexplicitly terminates the state machines 190. The patterns 178 in thepattern registry 133 may be instantiated as state machines 190 by acompute engine 145. When a state machine 190 reaches a halting state,the pattern 178 may be identified as being completely matched.

In one example, a first one of the services 106 may include a serverthat monitors user interaction with a shopping application on a clientdevice 121 while a second of the services 106 may include a server thatmonitors user interaction with a book reading application. When a userof a client application 118 interacts with a respective one of theapplications, the appropriate service 106 identifies the interaction andgenerates an event 109 describing the interaction. For example, theevent 109 may identify a type of interaction performed, such as addingan item to a virtual shopping cart, completing purchase of an item,pressing play or pause on a song, finishing a movie, or flipping a pagein a virtual book. The service 106 then communicates this event 109 tothe computing environment 112 for analysis.

When a pattern 178 in the pattern registry 133 has been matched for agiven user, e.g., when all events 109 specified in the pattern 178 havebeen identified in a stream of events 109 (or if the state machine 190that the compute engine 145 is executing to match a pattern 178 reportsa completed match), the action 182 to perform can be identified from theaction registry 135. In one embodiment, the action 182 is communicatedto an external application 185 for performance. For example, if anaction 182 includes rewarding a user with a coupon to an electroniccommerce system, the computing environment 112 may communicate with theelectronic commerce system to cause the coupon to be provided to theuser.

In further embodiments, the state machines 190 may have the ability toquery data stores, such as the compute engine index 137, the event datastore 130, a global data store, or other appropriate data stores, toperform event disambiguation. For example, a same event 109 may bereceived multiple times to the event listener 140 or the compute engine145. To make the events 109 idempotent, the state machines 190 may queryappropriate data stores to determine whether two events 109 are actuallya single event 109 received multiple times. As a result, the two events109 will not result in two matches to a pattern 178, rather a singlematch to the pattern 178.

Referring next to FIG. 2, shown in another drawing of the eventmonitoring system 100. As noted above, each of the services 106 may beindependent of another service 106. In the non-limiting example of FIG.2, the services 106 include a shopping application service 106 a and amedia player application service 106 b. The shopping application service106 a, for example, may serve up information that allows a user topurchase items through a particular type of client application 118. Themedia player application service 106 b may serve up media content, suchas movies, television shows, music, or other media content. Using asuitable client application 118, the user can watch the content, as maybe appreciated.

Issues may arise when events 109 are received from different services106 in different data formats. For example, the shopping applicationservice 106 a may generate events 109 for users that order items in ashopping application that may have unique fields, such as an orderidentification number, a transaction time, and a price. The media playerapplication service 106 b, however, may generate an event 109 thatincludes different fields, such as a title, a critics rating, a videolength and a video category. As shown in FIG. 2, an event 109 agenerated by the shopping application service 106 a can assume a JSONformat while an event 109 b generated by the media player applicationservice 106 b assumes an XML format. As the compute engines 145 a . . .145 b that analyze these type of events 109 may depend on particulardata fields and a format of a data structure of the event 109,additional logic would be required to handle all possible formats of anevent 109.

Accordingly, the event translator 143 may be employed to classify events109 and transform event data structures into a format desirable by thecompute engines 145 a . . . 145 b. In some embodiments, the eventtranslator 143 may apply filters to a data structure for an event 109,for example, to classify the event 109 or identify a type of the event109. In some embodiments, the filter may comprise a regular expressionfilter. A regular expression filter may include a sequence of charactersthat define a search pattern. Using the search pattern, a data structuremay be analyzed for one or more matches. Applying a regular expressionfilter may provide a lightweight and computationally efficient method ofclassifying an event 109, as may be appreciated.

Applying a regular expression filter may be performed programmatically,for example, in logic or source code of the event translator 143. Theregular expression filter may be applied to keys, values, or acombination thereof of a data structure for an event 109 to determine atype of the event 109 or, in other words, an event type. In someembodiments, the regular expression filter may look for a desiredstring, substring, or integer to determine an event type. For example,the regular expression filter may look to match “title” or “director” toidentify media player application events 109 (e.g., events 109 thatindicate an interaction with a media player application was performed).The regular expression can include:

/^(title|director) ([a-z0-9]{2, 6}+(_*)?)+[a-z0-9]$/,

or other appropriate regular expression. Thus, the regular expressionfilter will return a match for instances of “title” and “director” in adata structure for an event 109. The match can be used to classify theevent 109 as a media player event 109. As may be appreciated, theregular expression may be modified as needed to identify key or valuenaming conventions applied by the services 106 when generating events109.

Additionally, the event translator 143 may transform or convert a datastructure for an event 109 from a first format to a second formataccording to the common event schema 138. For example, the common eventschema 138 may indicate that all data structures for events 109communicated to the compute engines 145 be in one of an XML, JSON, orother type of format. Additionally, the common event schema 138 canindicate that key values, or variable names for data fields, have acommon label. After conversion, one or more compute engines 145interested in the event 109 may be identified and the data structure informat of the common event schema 138 may be communicated to theinterested compute engines 145.

Referring next to FIGS. 3A-3B, the structure of an event 109 a . . . 109b communicated in the event monitoring system 100 is shown according tovarious embodiments. Specifically, FIG. 3A shows a schematic diagram foran event 109 while FIG. 3B shows an example JSON data structure that maybe communicated over a network using hypertext transfer protocol (HTTP),hypertext transfer protocol secure (HTTPS), or other like protocol.While FIG. 3B shows a JSON data structure, other embodiments may includean XML data structure or similar data structures.

In various embodiments, an event 109 may generated by a service 106 toinclude an event identifier 303 a . . . 303 b, an event type 306 a . . .306 b, a customer identifier 309 a . . . 309 b, a timestamp 312 a . . .312 b, a service identifier 315 a . . . 315 b, as well as additionalinformation pertaining to a user interaction that caused the service 106to generate the event 109.

The event identifier 303 may include, for example, a unique identifierthat can be used to query an event 109 from the event data store 130 ata later time, if desired. The event type 306 may include an identifier,label, or other description capable of identifying a type of userinteraction that caused the event 109 to be generated and identifyingwhere which compute engines 145 to which the event 109 should be routed.In some embodiments, the event type 306 may identify a type of clientapplication 118 in which the user interaction occurred and/or the typeof user interaction. For example, the event type 306 may identify that auser purchased an item in a shopping application on his or her clientdevice 121.

The customer identifier 309 may include an identifier that uniquelyidentifies a user of a client device 121 or a user account associatedwith the client device 121. In embodiments in which compute engines 145are generated for each user account, the customer identifier 309 can beused by the event listener 140 to route the event 109 to appropriatecompute engines 145.

The timestamp 312 may include a time at which the user interactionoccurred or at which the event 109 was generated by the service 106. Theservice identifier 315 may include an identifier, label, or otherinformation that identifies which of the service 106 that generated andcommunicated the event 109 to the event processing application 129.

Turning now to FIG. 3C, a first event 109 a and a second event 109 b areshown prior to conversion by the event translator 143. For example, asthe first event 109 a includes information associated with a purchaseorder, the first event 109 a may be described as originating from ashopping application service 106, or similar service 106. Similarly, asthe second event 109 b includes information associated with a movie, thesecond event 109 b may be described as originating from a media playerapplication service 106, or similar service 106.

The first event 109 a is shown is a JSON format while the second event109 b is shown in an XML format. As a compute engine 145 may beinterested in both events 109, the compute engine 145 would have to beconfigured to interpret data in both XML and JSON formats. Additionally,the compute engine 145 would have to be familiar with variable names andother information.

Accordingly, prior to communicating an event 109 to the compute engine145, the event translator 143 may convert a data structure for an event109 from a first format to a second format according to the common eventschema 138. For example, the common event schema 138 may indicate thatall data structures for events 109 communicated to the compute engines145 be in one of an XML, JSON, or other type of format. Additionally,the common event schema 138 can indicate that key values, or variablenames for data fields, have a common label.

In the non-limiting example of FIG. 3C, the first event 109 a and thesecond event 109 b are converted into a JSON data format to generate afirst transformed event 109 c and a second transformed event 109 d.While the second event 109 b originated in an XML format, it may beconverted to a JSON format prior to communication to the compute engine145. The data fields may also be restructured according to the commonevent schema 138. For instance, the first transformed event 109 c andthe second transformed event 109 d may comprise uniform headers 318 a .. . 318 b that include, for example, an event identifier, an event type,and a customer identifier extracted from the original data structure andrenamed in accordance with the common event schema 138. All informationunrelated to information stored in the headers 318 a . . . 318 b may bestored as payloads 321 a . . . 321 b in the body of the data structure.In other words, the event translator 142 may select a portion of data inthe data structure for the event 109 for inclusion in a header of thenew data structure while placing the remaining portion of the data inthe data structure for the event 109 in a body of the new datastructure.

In another embodiment, the event translator 142 may select a portion ofdata in the data structure for the event 109 for inclusion in a headerof the new data structure while placing the entire data structure forthe event 109, as recited, in a body of the new data structure. Afterconversion, one or more compute engines 145 interested in the event 109may be identified and the data structure in format of the common eventschema 138 may be communicated to the interested compute engines 145.

Referring next to FIG. 4, shown is a state machine diagram 400 thatshows example functionality of a compute engine 145 implementing anevent-driven finite state machine 190 in the event monitoring system100. In various embodiments, a compute engine 145 may be generated for auser that attempts to identify one or more patterns 178 in a userlifecycle. For example, a user may create an account with a subscriptionwith an electronic commerce system, purchase various items over anamount of time, and eventually terminate his or her subscription.Administrators may desire to specify patterns 178 for compute engines145 to match while the user is subscribed to the service. The computeengine 145 generated by the event processing application 139 may monitora given user's lifecycle following the state machine diagram 400 shownin FIG. 4.

For example, the event processing application 139 can generate a computeengine 145 for a user account when a subscription is created. Aftercreation, the compute engine 145 may assume a sleep or hibernate modewhere the compute engine 145 does not actively consume computationalresources. Once a pattern 178 applicable to the user is created by anadministrator, an active mode is enabled where state machines 190 arespawned by the compute engine 148 to process events 109 received by thecompute engine 145 and match patterns 178. After computing one or moreevents 109 and/or matching one or more patterns, if no patterns 178require analysis by the compute engine 145, the compute engine 145 mayassume the sleep or hibernate mode until another pattern 178 applicablefor the user (and the compute engine 150) is created. This may continueuntil the user cancels his or her subscription. Thereafter, the computeengine 145 may terminate execution to free up memory or other computerresources.

In some embodiments, while a compute engine 145 operates in either thehibernate mode or the active mode, the compute engine 145 may beconfigured to monitor for additional patterns 178 to process. Forexample, while in the hibernate mode, the compute engine 145 may querythe pattern registry 133 once every three hours, or other predeterminedamount of time, to check for new patterns 178. If any new patterns 178are identified, the state of the compute engine 145 would transition tothe active mode, where events 109 from the event listener 140 may beprocessed. In some embodiments, the compute engine 145 includes avirtual machine or a thread in a parallel computing resource. In furtherembodiments, the compute engines 145 may be implemented in amaster-slave threaded computing environment.

Turning now to FIG. 5, shown is an example user interface 500 capable ofbeing rendered by an administrator client device 175 to specify apattern 178 and one or more actions 182 a . . . 182 e to be performedwhen a pattern 178 has been matched. For example, the administrator canspecify a user or group of users for whom a pattern 178 should beapplied. To this end, any compute engines 145 monitoring any of thespecified users will be notified of the pattern 178 and may match events109 a . . . 109 h to the pattern 178. In the example of FIG. 5, thepattern 178 may include three book read events 109 d . . . 109 f, amovie complete event 109 g, and a shopping purchase event 109 h. Whenthe pattern 178 is matched, the 5% gift coupon action 182 d and thenotify administrator actions 182 e may be performed by the eventprocessing application 139, or other appropriate application or service.

Referring next to FIG. 6, shown is a flowchart that provides one exampleof the operation of the event processing application 139 according tovarious embodiments. It is understood that the flowchart of FIG. 6provides merely an example of the many different types of functionalarrangements that may be employed to implement the operation of theevent processing application 139 as described herein. As an alternative,the flowchart of FIG. 6 may be viewed as depicting an example ofelements of a method implemented in the computing environment 112according to one or more embodiments.

Beginning with 603, a pattern 178 is specified by an administrator. Forexample, the event processing application 139 can serve up userinterface data to generate a user interface 500 similar to the one shownin FIG. 5. By selecting appropriate components in the user interface500, the administrator can specify a pattern 178 and an action 182 to beperformed when the pattern 178 is completed for any applicable users.The pattern 178 specified by the administrator can be received from theadministrator client device 175, as may be appreciated.

Next, in 606, the pattern 178 may be stored in the pattern registry 133or other suitable data store. As a compute engine 145 may execute for aparticular user account, the compute engine 145 may access the patternregistry 133 to identify patterns 178 for the particular user account.In 609, a specification of an action 182 to be performed when thepattern 178 is completed may also be received from the administratorclient device 175. In 612, the action 182 is stored in the actionregistry 135 or other suitable data store for later access.

Next, in 615, any user account subject to the pattern 178 may beidentified. In 618, a compute engine 145 may be generated for each ofthe user accounts subject to the pattern 178, if needed. In somescenarios, a compute engine 145 may already exist for a particular useraccount. In these situations, the compute engine 145 may not need begenerated and 618 may be skipped or omitted. In 621, the compute engines145 generated in 621 may be registered with the compute engine index137. This may include specifying that the compute engine 145 isinterested in particular types of events 109. The event listener 140 mayuse the compute engine index 137 to communicate events 109 to interestedcompute engines 145, as opposed to sending all events 109 to all computeengines 145. In 624, the pattern 178 may be assigned to the computeengines 145 corresponding to the user accounts associated with thepattern 178, such as those identified in 615. Thereafter, the processmay proceed to completion.

Referring next to FIG. 7, shown is a flowchart that provides one exampleof the operation of the event translator 143 according to variousembodiments. It is understood that the flowchart of FIG. 7 providesmerely an example of the many different types of functional arrangementsthat may be employed to implement the operation of the event translator143 as described herein. As an alternative, the flowchart of FIG. 7 maybe viewed as depicting an example of elements of a method implemented inthe computing environment 112 according to one or more embodiments.

Beginning with 703, the event translator 143 may identify an event 109received in a data stream generated by one of the services 106 as a userinteracts with a client application 118. In some embodiments, theservices 106 may execute in external computing resources 103 where theservices 106 communicate events 109 over a network to the computingenvironment 112 in no particular order. The event translator 143 mayobtain the event 109 from a buffer or queue where the event 109 isstored when received from a service 106.

Next, in 706, the event listener 140 may apply a filter to a datastructure for the event 109 (the “event data structure”) to classify theevent 109. Classifying the event 109 may include, for example,determining a type for the event 109. For example, the type of the event109 may describe an interaction performed by a user, such as selectingor manipulating a component of a user interface 500, adding an item to avirtual shopping cart, completing purchase of an item, pressing play orpause on a song, finishing a movie, or flipping a page in a virtualbook.

In some embodiments, the filter may include a regular expression filter.The regular expression filter may be applied to keys, values, or acombination thereof of the event data structure to determine a type forthe event 109. In some embodiments, the regular expression filter maylook for a desired string, substring, or integer to determine a type foran event 109. For example, the regular expression filter may look tomatch “purchas” (root for “purchase” or “purchasing”) or “order” toidentify purchase events 109 (e.g., events 109 that indicate an item waspurchased in a shopping application). The regular expression mayinclude:

/^(purchas|order) ([a-z0-9]{2, 6}+(_*)?)+[a-z0-9] $/,

or other suitable regular expression. Thus, the regular expressionfilter will return a match for instances of “purchase,” “purchasing,”and “order” in a data structure for an event 109. The match can be usedto classify the event 109 as a purchase event. As may be appreciated,the regular expression can be modified as needed to identify key orvalue naming conventions applied by the services 106 when generatingevents 109.

In further embodiments, the regular expression filter applied toclassify an event 109 may be selected from the filter data store 136. Inone example, a filter may be stored in the filter data store 136 inassociation with one or more services 106. When interpreting an event109 originating for a particular service 106, a filter corresponding tothe service 106 may be employed. To this end, the event translator 143may identify a suitable filter from potential filters stored in thefilter data store 136.

As may be appreciated, the filter may be a determinative factor fordetermining a type for an event 109. However, in additional embodiments,a type for an event 109 may be determined based at least in part on aservice 106 that generated the event 109, a type of user interactionthat prompted generation of the event 109, a type of client application118 in which the user interaction was identified, the regular expressionfilter, or other suitable information.

Next, in 709, the compute engine index 137 may be queried to identifycompute engines 145 interested in, or requiring access to, the type ofthe event 109 and/or a customer account associated with the event 109.For example, if the event 109 is identified as a purchase eventperformed in a shopping application, all compute engines 145 interestedin purchase events can be identified.

As the event 109 may eventually be communicated or otherwise madeavailable to the interested compute engines 145 for analysis, in somescenarios, it is beneficial to transform a data structure into one ableof interpretation by logic of a compute engine 145. In one embodiment, acommon event schema 138 is applied to all events 109 being communicatedto compute engines 145. In other embodiments, each compute engine 145may be associated with an event schema such that all events 109 providedto the compute engine 145 are transformed to comply with the eventschema. Additionally, in some situations, a pattern 178 requiresmatching against events 109 received from services 106; however, aninterested compute engine 145 does not exist or has not been generated.Hence, in 710, a determination may be made whether a new compute engine145 is required. For example, an administrator may define a new pattern178 and, when an event 109 is received, a compute engine 145 isgenerated dynamically to match patterns 178 interested in the event 109.

In 712, an event schema is identified for the interested compute engines145 and, in 715, the data structure for the event 109 is transformed tocreate a data structure in accordance with the event schema. In otherwords, the data structure of the event 109 as received from a service106 is converted from a first format to a second format according to thecommon event schema 317 or other event schema. In 718, the datastructure in the second format is communicated to the interested computeengines 145 for processing.

Turning now to FIG. 8, shown is a flowchart that provides one example ofthe operation of the compute engine 145 according to variousembodiments. It is understood that the flowchart of FIG. 8 providesmerely an example of the many different types of functional arrangementsthat may be employed to implement the operation of the compute engine145 as described herein. As an alternative, the flowchart of FIG. 8 maybe viewed as depicting an example of elements of a method implemented inthe computing environment 112 according to one or more embodiments.

Beginning with 803, a compute engine 145 may receive an event 109 fromthe event listener 140. Next, in 806, the compute engine 145 maydetermine whether the event 109 matches a pattern 178. As the computeengine 145 may execute for a given user or user account, the computeengine 145 may identify all patterns 178 associated with the user andmay determine whether the event 109 matches an event 109 in the one ormore patterns 178. If the event 109 received does not match events 109in the pattern 178, or no pattern 178 exists, the process can proceed to809 where the event 109 is discarded. Thereafter, the process canproceed to completion.

Referring back to 806, if, however, the event 109 matches a pattern 178,the process can proceed to 812 where the instance of the event 109matching an event 109 in the pattern 178 is registered in an appropriatedata store. In some embodiments, instances of an event 109 matching apattern 178 are stored in the compute engine index 137 or, in otherembodiments, the instances of an event 109 matching a pattern 178 arearchived, logged, or otherwise stored in a data store (e.g., an off-linedata store) for analytical analysis of the matching instances at a latertime.

Next, in 815, the compute engine 145 determines whether the pattern 178has been complete. In other words, the compute engine 145 determineswhether all events 109 included in a pattern 178 have been matched. Ifthe pattern 178 is not complete, the process may proceed to 815 wherethe compute engine 145 enters into a sleep or hibernation mode to awaitreceipt of the next event 109. Thereafter, the process may revert to803.

Referring back to 815, if the pattern 178 is complete, the process canproceed to 818 where an action 182 associated with the pattern 178 isidentified. This may include, for example, querying the action registry135 to identify an action 182 corresponding to the pattern 178 havingbeen completed. Next, in 821, the action 182 is performed. In someembodiments, the compute engine 145 may perform the action 182. In otherembodiments, the event processing application 139 may perform the action182 or the action 182 may be communicated to an external application 185for performance. In further embodiments, when a pattern 178 has beencompletely matched with events 109, the pattern 178 and associatedevents 109 and actions 182 may be stored in an off-line data store forarchival purposes as well as to free memory in the event data store 130,pattern registry 133, action registry 136, or other data store.Thereafter, the process may proceed to completion.

With reference to FIG. 9, shown is a schematic block diagram of thecomputing environment 112 according to an embodiment of the presentdisclosure. The computing environment 112 includes one or more computingdevices 900. Each computing device 900 includes at least one processorcircuit, for example, having a processor 903 and a memory 906, both ofwhich are coupled to a local interface 909. To this end, each computingdevice 900 may comprise, for example, at least one server computer orlike device. The local interface 909 may comprise, for example, a databus with an accompanying address/control bus or other bus structure ascan be appreciated.

Stored in the memory 906 are both data and several components that areexecutable by the processor 903. In particular, stored in the memory 906and executable by the processor 903 are the event processing application139, the event listener 140, the event translator 143, the computeengines 145, the state machine 190, and potentially other applications.Also stored in the memory 906 may be a data store 915 and other data.The data store 915 may include, for example, the event data store 130,the pattern registry 133, the action registry 135, and the computeengine index 137. In addition, an operating system may be stored in thememory 906 and executable by the processor 903.

It is understood that there may be other applications that are stored inthe memory 906 and are executable by the processor 903 as can beappreciated. Where any component discussed herein is implemented in theform of software, any one of a number of programming languages may beemployed such as, for example, C, C++, C#, Objective C, Java®,JavaScript®, Perl, PHP, Visual Basic®, Python®, Ruby, Flash®, or otherprogramming languages.

A number of software components are stored in the memory 906 and areexecutable by the processor 903. In this respect, the term “executable”means a program file that is in a form that can ultimately be run by theprocessor 903. Examples of executable programs may be, for example, acompiled program that can be translated into machine code in a formatthat can be loaded into a random access portion of the memory 906 andrun by the processor 903, source code that may be expressed in properformat such as object code that is capable of being loaded into a randomaccess portion of the memory 906 and executed by the processor 903, orsource code that may be interpreted by another executable program togenerate instructions in a random access portion of the memory 906 to beexecuted by the processor 903, etc. An executable program may be storedin any portion or component of the memory 906 including, for example,random access memory (RAM), read-only memory (ROM), hard drive,solid-state drive, USB flash drive, memory card, optical disc such ascompact disc (CD) or digital versatile disc (DVD), floppy disk, magnetictape, or other memory components.

The memory 906 is defined herein as including both volatile andnonvolatile memory and data storage components. Volatile components arethose that do not retain data values upon loss of power. Nonvolatilecomponents are those that retain data upon a loss of power. Thus, thememory 906 may comprise, for example, random access memory (RAM),read-only memory (ROM), hard disk drives, solid-state drives, USB flashdrives, memory cards accessed via a memory card reader, floppy disksaccessed via an associated floppy disk drive, optical discs accessed viaan optical disc drive, magnetic tapes accessed via an appropriate tapedrive, and/or other memory components, or a combination of any two ormore of these memory components. In addition, the RAM may comprise, forexample, static random access memory (SRAM), dynamic random accessmemory (DRAM), or magnetic random access memory (MRAM) and other suchdevices. The ROM may comprise, for example, a programmable read-onlymemory (PROM), an erasable programmable read-only memory (EPROM), anelectrically erasable programmable read-only memory (EEPROM), or otherlike memory device.

Also, the processor 903 may represent multiple processors 903 and/ormultiple processor cores and the memory 906 may represent multiplememories 906 that operate in parallel processing circuits, respectively.In such a case, the local interface 909 may be an appropriate networkthat facilitates communication between any two of the multipleprocessors 903, between any processor 903 and any of the memories 906,or between any two of the memories 906, etc. The local interface 909 maycomprise additional systems designed to coordinate this communication,including, for example, performing load balancing. The processor 903 maybe of electrical or of some other available construction.

Although the event processing application 139, the event listener 140,the event translator 143, the compute engine(s) 145, and other varioussystems described herein may be embodied in software or code executed bygeneral purpose hardware as discussed above, as an alternative the samemay also be embodied in dedicated hardware or a combination ofsoftware/general purpose hardware and dedicated hardware. If embodied indedicated hardware, each can be implemented as a circuit or statemachine that employs any one of or a combination of a number oftechnologies. These technologies may include, but are not limited to,discrete logic circuits having logic gates for implementing variouslogic functions upon an application of one or more data signals,application specific integrated circuits (ASICs) having appropriatelogic gates, field-programmable gate arrays (FPGAs), or othercomponents, etc. Such technologies are generally well known by thoseskilled in the art and, consequently, are not described in detailherein.

The flowcharts of FIGS. 6, 7, and 8 show the functionality and operationof an implementation of portions of the event processing application139, the event listener 140, and the compute engine(s) 145. If embodiedin software, each block may represent a module, segment, or portion ofcode that comprises program instructions to implement the specifiedlogical function(s). The program instructions may be embodied in theform of source code that comprises human-readable statements written ina programming language or machine code that comprises numericalinstructions recognizable by a suitable execution system such as aprocessor 903 in a computer system or other system. The machine code maybe converted from the source code, etc. If embodied in hardware, eachblock may represent a circuit or a number of interconnected circuits toimplement the specified logical function(s).

Although the flowcharts of FIGS. 6, 7, and 8 show a specific order ofexecution, it is understood that the order of execution may differ fromthat which is depicted. For example, the order of execution of two ormore blocks may be scrambled relative to the order shown. Also, two ormore blocks shown in succession in FIGS. 6, 7, and 8 may be executedconcurrently or with partial concurrence. Further, in some embodiments,one or more of the blocks shown in FIGS. 6, 7, and 8 may be skipped oromitted. In addition, any number of counters, state variables, warningsemaphores, or messages might be added to the logical flow describedherein, for purposes of enhanced utility, accounting, performancemeasurement, or providing troubleshooting aids, etc. It is understoodthat all such variations are within the scope of the present disclosure.

Also, any logic or application described herein, including the eventprocessing application 139, the event translator 143, and the computeengine(s) 145, that comprises software or code can be embodied in anynon-transitory computer-readable medium for use by or in connection withan instruction execution system such as, for example, a processor 903 ina computer system or other system. In this sense, the logic maycomprise, for example, statements including instructions anddeclarations that can be fetched from the computer-readable medium andexecuted by the instruction execution system. In the context of thepresent disclosure, a “computer-readable medium” can be any medium thatcan contain, store, or maintain the logic or application describedherein for use by or in connection with the instruction executionsystem.

The computer-readable medium can comprise any one of many physical mediasuch as, for example, magnetic, optical, or semiconductor media. Morespecific examples of a suitable computer-readable medium would include,but are not limited to, magnetic tapes, magnetic floppy diskettes,magnetic hard drives, memory cards, solid-state drives, USB flashdrives, or optical discs. Also, the computer-readable medium may be arandom access memory (RAM) including, for example, static random accessmemory (SRAM) and dynamic random access memory (DRAM), or magneticrandom access memory (MRAM). In addition, the computer-readable mediummay be a read-only memory (ROM), a programmable read-only memory (PROM),an erasable programmable read-only memory (EPROM), an electricallyerasable programmable read-only memory (EEPROM), or other type of memorydevice.

Further, any logic or application described herein, including the eventprocessing application 139, the event translator 143, and the computeengines 145, may be implemented and structured in a variety of ways. Forexample, one or more applications described may be implemented asmodules or components of a single application. Further, one or moreapplications described herein may be executed in shared or separatecomputing devices or a combination thereof. For example, a plurality ofthe applications described herein may execute in the same computingdevice 900, or in multiple computing devices in the same computingenvironment 112. Additionally, it is understood that terms such as“application,” “service,” “system,” “engine,” “module,” and so on may beinterchangeable and are not intended to be limiting.

Disjunctive language such as the phrase “at least one of X, Y, or Z,”unless specifically stated otherwise, is otherwise understood with thecontext as used in general to present that an item, term, etc., may beeither X, Y, or Z, or any combination thereof (e.g., X, Y, and/or Z).Thus, such disjunctive language is not generally intended to, and shouldnot, imply that certain embodiments require at least one of X, at leastone of Y, or at least one of Z to each be present.

It should be emphasized that the above-described embodiments of thepresent disclosure are merely possible examples of implementations setforth for a clear understanding of the principles of the disclosure.Many variations and modifications may be made to the above-describedembodiment(s) without departing substantially from the spirit andprinciples of the disclosure. All such modifications and variations areintended to be included herein within the scope of this disclosure andprotected by the following claims.

Therefore, the following is claimed:
 1. A non-transitorycomputer-readable medium embodying program code executable in at leastone computing device that, when executed, directs the at least onecomputing device to: receive a specification of a pattern of events andan action to be performed in association with the pattern of events froman administrator device; access an event received in a stream of eventsgenerated by a plurality of services, wherein the event describes atleast one instance of user interaction with at least one clientapplication executed on a client device, the event being received as adata structure in a first format; identify a source of the event fromthe services based at least in part on a service identifier; identify aregular expression filter from a plurality of potential regularexpression filters stored in a data store, the regular expression filterbeing identified from the data store based at least in part on thesource; apply the regular expression filter to the data structure in thefirst format to identify an event type for the event; identify a computeengine interested in the event, the compute engine identified based atleast in part on the event type; transform the data structure from thefirst format to a second format in accordance with a common event schemainterpretable by the compute engine interested in the event; andcommunicate the data structure in the second format to the computeengine, the compute engine being a virtual computing process configuredto: compare the event to the pattern of events; and in response to allevents in the pattern of events being matched, cause the action to beperformed.
 2. The non-transitory computer-readable medium of claim 1,wherein transforming the data structure from the first format to thesecond format comprises converting the data structure from an extensiblemarkup language (XML) format to a JavaScript object notation (JSON)format.
 3. The non-transitory computer-readable medium of claim 1,wherein transforming the data structure from the first format to thesecond format comprises converting the data structure from a JavaScriptobject notation (JSON) format to an extensible markup language (XML)format.
 4. The non-transitory computer-readable medium of claim 1,wherein: the compute engine is generated in response to a receipt of thespecification of the pattern of events and the action; and the computeengine is generated to correspond to an account associated with thepattern of events.
 5. A system, comprising: at least one computingdevice; and program instructions executable in the at least onecomputing device that, when executed by the at least one computingdevice, cause the at least one computing device to: receive aspecification of a pattern of events and an action to be performed inassociation with the pattern of events from an administrator device;access an event received in a stream of events generated by a pluralityof services, wherein the event describes at least one instance of userinteraction with at least one client application executed on a clientdevice; identify a regular expression filter from a plurality ofpotential regular expression filters stored in a data store, the regularexpression filter being identified from the data store based at least inpart on a source of the event; apply the regular expression filter to atleast a portion of the event to classify the event; identify a computeengine interested in the event, the compute engine identified based atleast in part on the event being classified using the regular expressionfilter; and communicate the event to the compute engine interested inthe event as classified, wherein the compute engine comprises a virtualcomputing process configured to: compare the event to the pattern ofevents; and in response to all events in the pattern of events beingmatched, cause the action to be performed.
 6. The system of claim 5,wherein the event is received as a data structure in a first format. 7.The system of claim 6, further comprising program instructionsexecutable in the at least one computing device that, when executed bythe at least one computing device, cause the at least one computingdevice to transform the data structure from the first format to a secondformat.
 8. The system of claim 7, wherein transforming the datastructure from the first format to the second format further comprises:identifying a common event schema from a data store, the common eventschema interpretable by the compute engine; and generating a new datastructure in the second format in accordance with the common eventschema.
 9. The system of claim 8, wherein generating the new datastructure in the second format in accordance with the common eventschema further comprises: selecting a first portion of data accessedfrom the data structure for inclusion in a header of the new datastructure; and placing a second portion of data accessed from the datastructure in a body of the new data structure.
 10. The system of claim5, wherein the compute engine is a virtual machine executed in the atleast one computing device or a thread processed in the at least onecomputing device.
 11. The system of claim 5, wherein: the event is oneof a plurality of events; and individual ones of the services comprisean event reporting agent configured to generate the events.
 12. Thesystem of claim 5, wherein: the compute engine is generated in responseto a receipt of the specification of the pattern of events and theaction; and the compute engine is generated to correspond to an accountassociated with the pattern of events.
 13. A method, comprising:receiving, by at least one computing device comprising at least onehardware processor, a specification of a pattern of events and an actionto be performed in association with the pattern of events from anadministrator device; receiving, by the at least one computing device,an event in a data stream generated by a plurality of services, whereinthe event describes at least one instance of user interaction with atleast one client application executed on a client device, the eventbeing received as a data structure in a first format; identifying, bythe at least one computing device, a regular expression filter from aplurality of potential regular expression filters stored in a datastore, the regular expression filter being identified from the datastore based at least in part on a source of the event; applying, by theat least one computing device, the regular expression filter to the datastructure in the first format to identify an event type for the event;accessing, by the at least one computing device, a common event schemaassociated with a plurality of virtual compute engines configured toprocess the event; transforming, by the at least one computing device,the data structure from the first format to a second format based atleast in part on the common event schema; identifying, by the at leastone computing device, at least one of the virtual compute enginesinterested in the event based at least in part on the event type of theevent; and communicating, by the at least one computing device, the datastructure in the second format to the at least one of the virtualcompute engines, wherein the at least one of the virtual compute enginescomprises a virtual computing process configured to: compare the eventto the pattern of events; and in response to all events in the patternof events being matched, cause the action to be performed.
 14. Themethod of claim 13, further comprising: identifying, by the at least onecomputing device, the source of the event from the services based atleast in part on a service identifier, wherein the regular expressionfilter is identified from the plurality of potential regular expressionfilters stored in the data store based at least in part on the serviceidentifier.
 15. The method of claim 13, wherein individual ones of thevirtual compute engines comprise a virtual machine executed in the atleast one computing device or a thread processed in the at least onecomputing device.
 16. The method of claim 14, further comprising:generating, by the at least one computing device, the at least one ofthe virtual compute engines; and registering, by the at least onecomputing device, the at least one of the virtual compute engines in acompute engine index in association with at least one interested eventtype.
 17. The method of claim 16, wherein the at least one of thevirtual compute engines interested in the event is identified byquerying, by the at least one computing device, the compute engine indexto identify the at least one of the virtual compute engines associatedwith the at least one interested event type.
 18. The method of claim 17,wherein the at least one interested event type is a same type of eventas the event type identified for the event.
 19. The method of claim 13,wherein transforming the data structure from the first format to thesecond format based at least in part on the common event schemacomprises converting the data structure from a JavaScript objectnotation (JSON) format to an extensible markup language (XML) format.20. The method of claim 13, further comprising generating, by the atleast one computing device, the at least one of the virtual computeengines in response to a receipt of the specification of the pattern ofevents and the action, wherein the at least one of the virtual computeengines is generated to correspond to an account associated with thepattern of events.